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Amendments to the Claims: 

Please cancel claims 1-18, without prejudice. 

This listing of claims will replace all prior versions, and listings of claims in the 
application: 

Listing of Claims: 
1-18. (Cancelled) 

19. (Previously Presented) A method comprising: 

providing a first service processing switch at a first point-of-presence 
(POP) associated with a first site of a first subscriber of a service provider and a 
first site of a second subscriber of the service provider; 

providing a second service processing switch at a second POP associated 
with a second site of the first subscriber and a second site of the second 
subscriber, wherein the first service processing switch and the second service 
processing switch are communicatively coupled via a network; 

logically connecting a plurality of processors of the first service 
processing switch into a packet-passing ring configuration; 

logically connecting a plurality of processors of the second service 
processing switch into a packet-passing ring configuration; 

establishing a first set of virtual routers on the plurality of processors of 
the first service processing switch; 

establishing a second set of virtual routers on the plurality of processors of 
the second service processing switch; 

providing the first subscriber with a first set of customized application 
layer services and the second subscriber with a second set of customized 
application layer services and providing subscriber resource isolation by 

partitioning the first set of virtual routers and the second set of 

virtual routers between the first subscriber and the second subscriber 
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including (i) allocating and configuring a first partition, comprising a first 
subset of the first set of virtual routers and a first subset of the second set 
of virtual routers, to the first subscriber and (ii) allocating and configuring 
a second partition, comprising a second subset of the first set of virtual 
routers and a second subset of the second set of virtual routers, to the 
second subscriber, 

providing the first subscriber with a first virtual private network 
(VPN) communicatively coupling the first site of the first subscriber with 
the second site of the first subscriber by establishing a first secure tunnel 
through the network between virtual routers of the first partition, and 

providing the second subscriber with a second virtual private 
network (VPN) communicatively coupling the first site of the second 
subscriber with the second site of the second subscriber by establishing a 
second secure tunnel through the network between virtual routers of the 
second partition; and 

providing changeable provisioning of processing capacity between the 
first subscriber and the second subscriber by programmatically dynamically 
reallocating resources of the first service processing switch or the second service 
processing switch between the first partition and the second partition based on 
comparative processing demands of the first set of customized application layer 
services and the second set of customized application layer services. 

20. (Previously Presented) The method of claim 19, wherein the first set of 
customized application layer services comprises firewall protection. 

21. (Previously Presented) The method of claim 20, wherein the first set of 
customized application layer services comprises web site hosting. 

22. (Previously Presented) The method of claim 20, wherein the first set of 
customized application layer services comprises e-mail services. 
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23. (Previously Presented) The method of claim 19, wherein the first secure 
tunnel and the second secure tunnel are established by sharing a single secure 
tunnel between the first service processing switch and the second service 
processing switch. 

24. (Previously Presented) The method of claim 19, wherein in said providing 
changeable provisioning of processing capacity between the first subscriber and 
the second subscriber is controlled by a services management system of the 
service provider. 

25. (Previously Presented) The method of claim 19, wherein the plurality of 
processors of the first service processing switch are associated with one or more 
control blades, one or more access blades, and one or more processing blades. 

26. (Previously Presented) The method of claim 19, wherein packets exchanged 
between the first service processing switch and the second processing switch 
contain processor identifiers (PEIDs) that identify a processor of the plurality of 
processors of the first service processing switch or a processor of the plurality of 
processors of the second service processing switch to which the packets are 
destined. 

27. (Previously Presented) The method of claim 26, wherein the packets contain 
logical queue identifiers (LQIDs) that identify a software entity to which the 
packets are destined within the identified processor. 
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